CVE-2025-58944: 
WordPress vulnerability analysis and mitigation

CVE-2025-58944 is a Local File Inclusion (LFI) vulnerability in the axiomthemes Manufactory WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Manufactory theme up to and including version 1.4, and allows unauthenticated network attackers to include arbitrary local files from the server. The vulnerability was reported by security researcher "Bonds" on August 3, 2025, and published by Patchstack on September 2, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Manufactory theme (CWE-98), which allows user-supplied input to influence which local file is included and executed. An unauthenticated remote attacker can craft a malicious HTTP request that manipulates a filename parameter to traverse the file system and include sensitive local files, causing their contents to be rendered in the server response. No user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. Exposure of database credentials could lead to complete database takeover, unauthorized data access, and potential full site compromise. The vulnerability also poses risks to confidentiality, integrity, and availability, as rated High across all three impact categories in the CVSS score (Patchstack).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability requires no authentication or user interaction, making it attractive for mass-exploit campaigns targeting WordPress sites at scale, as noted by Patchstack. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Manufactory theme (version ≤ 1.4) via passive scanning tools such as WPScan, Shodan, or by inspecting theme metadata in page source (/wp-content/themes/manufactory/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP source or known behavior to locate a filename parameter passed to a PHP include/require statement without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP GET or POST request to the vulnerable endpoint, supplying a path traversal payload (e.g., ../../../../wp-config.php) in the filename parameter.
4. Retrieve sensitive files: If successful, the server response will contain the contents of the targeted file (e.g., wp-config.php with database credentials, /etc/passwd, or other sensitive server files).
5. Escalate access: Use exposed database credentials to access the WordPress database directly, potentially enabling full site takeover, creation of admin accounts, or further lateral movement (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body; repeated requests from a single IP to theme-related PHP files.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting Manufactory theme files; HTTP 200 responses to requests containing wp-config, passwd, or other sensitive file names in parameters.
• File System: No new files expected from LFI alone, but monitor for unexpected file reads or access to wp-config.php, /etc/passwd, or other sensitive files by the web server process.
• Process: Unusual database connection attempts from new or external IP addresses following potential credential exposure via LFI (Patchstack).

As of the time of publication, no official patch from the theme developer (axiomthemes) is available for the Manufactory theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should consider replacing or disabling the theme if an upgrade path is unavailable, implementing web application firewall (WAF) rules to block path traversal patterns, and restricting network-level access to the WordPress installation where possible. Monitoring server logs for suspicious file inclusion attempts is also recommended (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," has classified it as high priority and noted that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites. No significant vendor statements from axiomthemes or broader media coverage have been identified at this time (Patchstack).